Audit and Assurance · Communication on internal control

Internal Control Deficiencies and Significant Deficiencies under ISA 265

Updated 11 October 2026 · Fact-checked

A deficiency exists when a control is poorly designed, does not operate as intended, or is missing. A significant deficiency is one that, in the auditor's professional judgement, is important enough to merit the attention of those charged with governance. You identify it, judge its importance, then report it in writing.

Understand Internal Control Deficiencies and Significant Deficiencies

Start with the basic idea. Management sets up controls to prevent, detect and correct errors and fraud. The auditor looks at these controls to assess risk and decide the audit approach. While doing this, the auditor often finds that some controls do not work properly.

ISA 265 calls these weaknesses deficiencies in internal control. A deficiency exists in two situations. First, a control is designed, implemented or operated in a way that cannot prevent, or detect and correct, misstatements on a timely basis. Second, a control that is needed is missing. So a deficiency can be a design problem, an operation problem, or an absence.

Not every deficiency matters equally. A significant deficiency is a deficiency, or a combination of deficiencies, that in the auditor's professional judgement is of sufficient importance to merit the attention of those charged with governance. The test is judgement, not a fixed monetary limit.

The auditor does not have to search for deficiencies as a separate task. ISA 265 applies to those the auditor has identified while obtaining an understanding of controls and performing tests of controls. The audit is not designed to find every weakness, so the absence of a reported deficiency does not mean controls are effective.

To judge significance, consider the likelihood that the deficiency could lead to a material misstatement, and the potential magnitude of that misstatement. Misstatement does not need to have actually occurred. Also consider whether compensating controls exist, and whether several deficiencies together raise the risk.

Key rules to remember

Deficiency (ISA 265): Deficiency = control cannot prevent, or detect and correct, misstatements on a timely basis OR a necessary control is missing; Covers design, implementation, operation and absence of controls.
Significant deficiency (ISA 265): Significant deficiency = deficiency (or combination) important enough, in the auditor's judgement, to merit attention of those charged with governance; Judgement-based. No fixed monetary threshold.
Factors in judging significance: Likelihood of misstatement + potential magnitude + presence of compensating controls + combined effect; A misstatement does not have to have occurred already.
Reporting requirement: Significant deficiencies: communicate in writing to those charged with governance on a timely basis. Other deficiencies: communicate to management at an appropriate level, unless inappropriate.; Written communication is required for significant deficiencies. Include a description and an explanation of the potential effects.

How to solve Internal Control Deficiencies and Significant Deficiencies questions

Use this method for any question asking you to identify, assess or report control deficiencies.

1Read the scenario and list each control weakness. Look for missing controls, poorly designed controls and controls not followed.
2For each one, say what could go wrong: which misstatement, fraud or loss could result, and in which balance or class of transactions.
3Judge significance: how likely is a material misstatement, how large could it be, and are there compensating controls?
4Decide which items are significant deficiencies. Consider whether several minor ones combine into a significant one.
5State the recommendation: a practical control management could add or fix, linked to the specific weakness.
6Say who to tell and how: significant deficiencies in writing to those charged with governance; others to management.
7Check the answer uses the format deficiency, potential consequence, recommendation.

Quickest way: Deficiency, consequence, recommendation

When to use it: Use in Section B or C when a scenario lists control weaknesses and you have limited time.

Underline each weakness in the scenario as you read.
Write a three-part line for each: deficiency, consequence, recommendation.
Mark the ones with the biggest potential misstatement or fraud risk as significant.
Add one sentence on written communication to those charged with governance.
For objective questions, check the exact wording: deficiency versus significant deficiency, and who receives the report.

Common mistakes in Internal Control Deficiencies and Significant Deficiencies

Treating every deficiency as significant.
Students assume any weakness must go to the board.
Fix: Judge likelihood and magnitude of misstatement. Minor items go to management, significant ones to those charged with governance.
Forgetting that a missing control is a deficiency.
Students look only for controls that failed.
Fix: Ask what control should exist but does not, such as no authorisation of payments or no bank reconciliation.
Giving a vague recommendation like 'improve controls'.
Time pressure and lack of practice.
Fix: Name a specific control linked to the weakness, such as a second person approving supplier bank detail changes.
Saying a deficiency is significant only if a misstatement has occurred.
Students confuse deficiency with error found.
Fix: Remember the test is whether a misstatement could occur and not be prevented or detected timely.
Stating that the auditor must report to management only, or only orally.
Mixing up the reporting rules for the two categories.
Fix: Significant deficiencies must be communicated in writing to those charged with governance. Also report to management where appropriate.
Ignoring compensating controls.
Students focus on the weakness alone.
Fix: Check whether another control reduces the risk. If so, the deficiency may be less significant.

Worked examples

Example 1

During the audit of Kiran Co, you find that the same employee raises purchase orders, records supplier invoices and releases payments. No one reviews supplier bank detail changes. Identify the deficiencies, explain whether they are significant and recommend improvements.

Show the solution

Deficiency 1: no segregation of duties over purchasing and payments. Consequence: errors or fraud, such as payments to fictitious suppliers, may go undetected.
Deficiency 2: no review of changes to supplier bank details. Consequence: payments could be diverted to fraudulent accounts.
Significance: both are missing controls over cash payments, an area with high fraud risk and potentially large amounts. No compensating controls are mentioned. Together they are likely significant.
Recommendation 1: split the roles between different staff, with payment release requiring independent authorisation.
Recommendation 2: require independent verification and approval of all bank detail changes.
Reporting: communicate the significant deficiencies in writing to those charged with governance, with description and potential effects, and also inform management.

Answer: Both are deficiencies and, in combination, significant. Report them in writing to those charged with governance, recommending segregation of duties and independent approval of supplier bank detail changes.

Example 2

A client's monthly bank reconciliation is sometimes completed one week late. The reconciliations are always reviewed by the finance director and no errors have ever been found. Is this a significant deficiency?

Show the solution

Identify the deficiency: the control operates, but not on a timely basis, so it may not detect misstatements promptly.
Consider the likelihood and magnitude: errors could remain undetected for up to a week longer than intended, but the finance director's review provides a detective control.
Consider compensating controls: the review exists and no errors have been found, which reduces the risk.
Conclude using judgement: likely a deficiency of low significance rather than a significant deficiency.
Action: report it to management at an appropriate level, recommending that reconciliations be completed within a set deadline.

Answer: It is a deficiency but probably not significant, given the compensating review. Report it to management and recommend a firm deadline.

Exam tips

Use ISA 265 wording: 'deficiency', 'significant deficiency' and 'those charged with governance'. Do not use older terms such as 'weakness' alone.
Always link a weakness to a consequence and a recommendation. Marks are usually split across these three parts.
In objective questions, read carefully for 'in writing' and 'timely basis' since these often decide the answer.
Do not give a monetary rule for significance. Say it is a matter of professional judgement.
Where a scenario lists many small weaknesses, mention that they may be significant in combination.

Internal Control Deficiencies and Significant Deficiencies in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Control Deficiencies and Significant Deficiencies: frequently asked questions

What is a significant deficiency in internal control?

It is a deficiency, or a combination of deficiencies, that in the auditor's professional judgement is important enough to merit the attention of those charged with governance. There is no fixed monetary limit. It depends on likelihood and magnitude of potential misstatement.

What is the difference between a deficiency and a significant deficiency?

A deficiency is any control weakness, including a missing control. A significant deficiency is one important enough that governance should be told. Every significant deficiency is a deficiency, but not the reverse.

How does an auditor identify control deficiencies?

Mainly while understanding the entity's controls and performing tests of controls. Walkthroughs, inquiry, observation and inspection of documents can reveal controls that are missing, badly designed or not operating.

Who receives the communication of deficiencies under ISA 265?

Significant deficiencies go in writing to those charged with governance on a timely basis. Other deficiencies are communicated to management at an appropriate level, unless this would be inappropriate in the circumstances.